Forum Replies Created
-
Posts
-
TDI filter илм LSP, но вообще говоря таблицу активных соединений с PID можно получить у стека и без дополнительных усилий начиная с Windows XP.
ЗЫ Название темы подправип, беда с этими кодировками…
But on 2000 I have only SectionHandle and that handle is valid in the HANDLE_TABLE of corresponding process not in process in the context of which my driver is getting called.
KeAttachProcess/KeDetachProcess should help 8)
Can you direct me to any websites that document the shifting of the SEQ and ACK fields. Also is shifting a set incremental value or is it based on the content of the packet?
I don’t think you will be able to find this sort of information anywhere. The only thing I can suggest is reading some good description of TCP protocol (by R. Stevens http://www.kohala.com/start/ an example).
Yes there is last field EPROCESS block which points to a UNICODE_STRING which gives me the FullPathName , but still I am not able to get the Drive Letters form there.
You have not explained in what form you get full path name here and I supposed you have got volume device name instead drive letter. Seems I got wrong 😳
Anyways, why won’t you use the approach I posted above in this thread:
1. Obtain EPROCESS pointer through IoGetCurrentProcess().
2. For NT 4.0 and 5.0 take section handle from EPROCESS(SectionHandle) and using ObReferenceObjectByHandle() we obtain SectionObject; for NT 5.1 we can take SectionObject from EPROCESS directly.
3. From SectionObject we obtain SegmentObject.
4. From SegmentObject we obtain ControlArea.
5. From ControlArea we obtain FilePointer (this is FileObject pointer).
6. Using ObQueryNameString() we obtain full process name
All operations should be performed on PASSIVE_LEVEL and in the context of the process we obtain full path for.This one is proved to work.
Yes there is last field EPROCESS block which points to a UNICODE_STRING which gives me the FullPathName , but still I am not able to get the Drive Letters form there.
Drive letter is a symbolic link to disk object, so you can enumerate symbolic links to get the exact mappings.
I had one more query ,what does DEVICEMAP field in EPROCESS strucure signify…?
Devicemap is used when object manager sees a name beginning from ?? for getting the object directory to use for the particular process.
Using my intercepting application, can I send a tcp request to one of the two applications by filling the Request.EthPacket.Buffer with a new packet that I create and then send it using SendPacketToMstcp or SendPacketToAdapter?
Yes, you can. However, please note that injecting data into the TCP stream is not as easy as it may seem at the first look, because you should properly shift SEQ and ACK fields in your newly inserted packet and all sequent packets.
Would either application be able to tell that the packet didn’t originate from the application it is connected to?
If packet is injected properly then it won’t.
'Dump packet size
sOut = sOut & vbTab & "Packet size = " & PacketBuffer.m_Length & vbCrLf
CopyMemory EthHeader, PacketBuffer.m_IBuffer(0), Len(EthHeader)
The code above is taken from VB passthru sample. Here PacketBuffer.m_IBuffer array contains the entire packet, you can dump it if necessary.
Samples can be compiled with VC6 or VC2005 (projects are provided). You can convert VC6 project to VC2003 one if necessary. The binaries in the package are built with VC6 in order to support Windows 95.
Подскажи пожалуйста в каком разделе в DDK это можно почитать?
Описание NdisRegisterProtocol например…
т.е. лучше создавать свой поток в драйвере при сохранении? какойнибудь там ZwCreateThread функцией?
PsCreateSystemThread
Обязательность или опционально сть обработчиков в NDIS_PROTOCOL_CHARACTERISTICS и NDIS_MINIPORT_CHARACTERISTICS описана в DDK, большинство из них нужны.
Сохранять в файл можно и из ядра (лучше из отдельного потока работающего на IRQL_PASSIVE_LEVEL, так как receive всегда приходит на IRQL_DISPATCH_LEVEL).
@kdub wrote:
Hi,
Is the PacketBuffer.m_Length property supposed to hold the length of the entire packet or does it contain the total length of the headers (ETH,IP,TCP)?Yes, this is entire packet length (headers and payload).
@kdub wrote:
I am filtering for only ETH_P_IP packets and the m_Length is always 54 which appears to be the header sizes (14,20,20). I am not able to get the payload data but I can get the IP and TCP header data successfully.
Believe or not, not all packets on the network are 54 bytes length and not all packets are TCP. In order to check if packet is TCP you have to check protocol field on the IP header which specifies next protocol.
@kdub wrote:
What is the correct way to get the length of the entire packet (ETH, IP, TCP,PAYLOAD,CHECKSUM) using the VB PassThru example?
Read Ethernet header, check if next protocol is IP. Read IP header, check if next protocol is TCP. If it is then read TCP header and follow up data if there is any.
You can’t affect cache manager behavior from user mode, however there is another way to do what you want. You can map each of 2000 files into the process memory (CreateFileMapping and MapViewOfFile), 20 megs should easily fit your process address space. Then read one byte from each page (each 4K) of each mapping, this will force system to bring all files into memory.
However, I would not force system to fetch all data from disk at once, but better postpone each fetch operation when it is really necessary.
@kdub wrote:
What is the difference between the NDISAPI.dll provided with the sample applications and the one provided with the Individual license?
There is no difference. DLL in the trial package is fully functional.
The IP and TCP headers are all contained in the same packet right?
Yes
What are the sizes of the IP header and TCP header?
IP header is usually 20 bytes length, but the actual length is specified in the header itself(http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/ip-packet.html). Same for TCP header (http://www.wtcs.org/snmp4tpc/images/TCP-Header.jpg) TCP header follows IP header, but IP can be used as transport for many other protocols, UDP, ICMP, GRE and etc…
Does the data/payload section always follow the TCP header?
If TCP packet contains data then yes they follow TCP header.
